CVE-2025-40301 — CVE & Security Advisory Radar

🎯 CVE-2025-40301 HIGH 7.6 🔥 EPSS 27% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2025-40301 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the return status. However, parameter data has previously been pulled in hci_event_func(), which may leave the skb empty. If so, using skb->data[0] for the return status uses un-init memor

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_event: validate skb length for unknown CC opcode

In hci_cmd_complete_evt(), if the command complete event has an unknown
opcode, we assume the first byte of the remaining skb->data contains the
return status. However, parameter data has previously been pulled in
hci_event_func(), which may leave the skb empty. If so, using skb->data[0]
for the return status uses un-init memory.

The fix is to check skb->len before using skb->data.

Klassifikation & Betroffenheit:

Linux Linux patch: 6.17.8Linux afcb3369f46ed5dc883a7b92f2dd1e264d79d388 <1a0ddaaf97405dbd11d4cb5a961a3f82400e8a50Linux patch: 6.6.117Linux afcb3369f46ed5dc883a7b92f2dd1e264d79d388 <5c5f1f64681cc889d9b13e4a61285e9e029d6ab5Linux afcb3369f46ed5dc883a7b92f2dd1e264d79d388 <779f83a91d4f1bf5ddfeaf528420cbb6dbf03fa8Linux afcb3369f46ed5dc883a7b92f2dd1e264d79d388 <cf2c2acec1cf456c3d11c11a7589e886a0f963a9Linux 6.1Linux patch: 6.12.58

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2026-74521 9.1 CVE-2026-74476 9.1 CVE-2026-74287 9.1 CVE-2026-72348 9.1 CVE-2026-72320 9.1

🩹 Patch verfügbar (OSV):

🩹 Kernel ≥ 6.1.159 🩹 Kernel ≥ 6.6.117 🩹 Kernel ≥ 6.12.58 🩹 Kernel ≥ 6.17.8

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2025

Veröffentlicht 12/2025

Heute 03.09.

CVSS-Vektor-Analyse: 7.6

AV · Angriffsvektor Benachbart

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Gering

I · Integrität Gering

A · Verfügbarkeit Hoch

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Veröffentlicht:08.12.2025

Aktualisiert:30.07.2026 06:24

Assigner (CNA):Linux

EUVD-ID:EUVD-2025-201644

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Kernel-Paket aktualisieren (apt upgrade linux-image / yum update kernel) und System neu starten.

Tier	2026-08-29	2026-09-02
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

7.6 HIGH

🇪🇺 EUVD

EPSS

27%

CVE-2025-40301 🌐 Adjacent Network 🔓 Keine Authentifizierung nötig

Linux

CVE-2025-40301 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_event: validate skb length for unknown CC opcode In hci_cmd_complete_evt(), if the command complete event has an unknown opcode, we assume the first byte of the remaining skb->data contains the return status. However, parameter data has previously been pulled in hci_event_func(), which may leave the skb empty. If so, using skb->data[0] for the return status uses un-init memor

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Kernel-Paket aktualisieren (apt upgrade linux-image / yum update kernel) und System neu starten.

08.12.2025

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub